@drawbridge/drawbridge-utils 0.0.22 → 0.0.24

package/dist/cdn.cjs

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // cdn.js
 var cdn_exports = {};
 __export(cdn_exports, {
+  cdnShopify: () => cdnShopify,
   cdnSrc: () => cdnSrc
 });
 module.exports = __toCommonJS(cdn_exports);
@@ -31,7 +32,21 @@ var cdnSrc = (asset, size, timestamp) => {
     "?query=" + timestamp
   ].join("");
 };
+var cdnShopify = (url, size, timestamp) => {
+  if (!url) return void 0;
+  try {
+    const parsed = new URL(url);
+    const [width, height] = (size || "").split("x").map(Number);
+    if (width) parsed.searchParams.set("width", String(width));
+    if (height) parsed.searchParams.set("height", String(height));
+    if (timestamp) parsed.searchParams.set("v", String(new Date(timestamp).getTime()));
+    return parsed.toString();
+  } catch {
+    return void 0;
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  cdnShopify,
   cdnSrc
 });

package/dist/cdn.d.cts

@@ -17,4 +17,36 @@ const cdnSrc = ( asset, size, timestamp ) => {
 
 };
 
-export { cdnSrc };
+// Build a Shopify CDN URL with on-the-fly resize. Shopify CDN supports
+// `?width=`/`?height=` query params for server-side resizing, so the
+// caller doesn't need a pre-generated sizes map (unlike cdnSrc).
+// `url` is a Shopify CDN URL string. `size` is the same WxH grammar as
+// cdnSrc (e.g. '100x100') — parsed into width/height query params.
+// `timestamp` is optional: Shopify URLs typically already carry their
+// own `?v=` versioning, so a missing timestamp does not produce a stale
+// asset the way it does with cdnSrc. When provided, the timestamp
+// overrides any existing `v=` to force cache-bust across updates.
+const cdnShopify = ( url, size, timestamp ) => {
+
+	if( ! url ) return undefined;
+
+	try {
+
+		const parsed = new URL( url );
+		const [ width, height ] = ( size || '' ).split( 'x' ).map( Number );
+
+		if( width ) parsed.searchParams.set( 'width', String( width ) );
+		if( height ) parsed.searchParams.set( 'height', String( height ) );
+		if( timestamp ) parsed.searchParams.set( 'v', String( new Date( timestamp ).getTime() ) );
+
+		return parsed.toString();
+
+	} catch {
+
+		return undefined;
+
+	}
+
+};
+
+export { cdnShopify, cdnSrc };

package/dist/cdn.d.ts

@@ -17,4 +17,36 @@ const cdnSrc = ( asset, size, timestamp ) => {
 
 };
 
-export { cdnSrc };
+// Build a Shopify CDN URL with on-the-fly resize. Shopify CDN supports
+// `?width=`/`?height=` query params for server-side resizing, so the
+// caller doesn't need a pre-generated sizes map (unlike cdnSrc).
+// `url` is a Shopify CDN URL string. `size` is the same WxH grammar as
+// cdnSrc (e.g. '100x100') — parsed into width/height query params.
+// `timestamp` is optional: Shopify URLs typically already carry their
+// own `?v=` versioning, so a missing timestamp does not produce a stale
+// asset the way it does with cdnSrc. When provided, the timestamp
+// overrides any existing `v=` to force cache-bust across updates.
+const cdnShopify = ( url, size, timestamp ) => {
+
+	if( ! url ) return undefined;
+
+	try {
+
+		const parsed = new URL( url );
+		const [ width, height ] = ( size || '' ).split( 'x' ).map( Number );
+
+		if( width ) parsed.searchParams.set( 'width', String( width ) );
+		if( height ) parsed.searchParams.set( 'height', String( height ) );
+		if( timestamp ) parsed.searchParams.set( 'v', String( new Date( timestamp ).getTime() ) );
+
+		return parsed.toString();
+
+	} catch {
+
+		return undefined;
+
+	}
+
+};
+
+export { cdnShopify, cdnSrc };

package/dist/cdn.js

@@ -8,6 +8,20 @@ var cdnSrc = (asset, size, timestamp) => {
     "?query=" + timestamp
   ].join("");
 };
+var cdnShopify = (url, size, timestamp) => {
+  if (!url) return void 0;
+  try {
+    const parsed = new URL(url);
+    const [width, height] = (size || "").split("x").map(Number);
+    if (width) parsed.searchParams.set("width", String(width));
+    if (height) parsed.searchParams.set("height", String(height));
+    if (timestamp) parsed.searchParams.set("v", String(new Date(timestamp).getTime()));
+    return parsed.toString();
+  } catch {
+    return void 0;
+  }
+};
 export {
+  cdnShopify,
   cdnSrc
 };

package/dist/shopify.cjs

@@ -32,9 +32,13 @@ __export(shopify_exports, {
   getAdminToken: () => getAdminToken,
   ping: () => ping,
   refreshAdminToken: () => refreshAdminToken,
-  resolveConnectionSettings: () => resolveConnectionSettings
+  resolveConnectionSettings: () => resolveConnectionSettings,
+  signOAuthState: () => signOAuthState,
+  verifyOAuthCallbackHmac: () => verifyOAuthCallbackHmac,
+  verifyOAuthState: () => verifyOAuthState
 });
 module.exports = __toCommonJS(shopify_exports);
+var import_crypto3 = __toESM(require("crypto"), 1);
 
 // encrypt.js
 var import_crypto2 = __toESM(require("crypto"), 1);
@@ -79,6 +83,48 @@ var decrypt = (value) => {
 var SHOPIFY_ADMIN_API_VERSION = "2025-01";
 var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
 var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var OAUTH_STATE_TTL_MS = 5 * 60 * 1e3;
+var signOAuthState = ({ organizationId, shop }) => {
+  const payload = Buffer.from(JSON.stringify({
+    exp: Date.now() + OAUTH_STATE_TTL_MS,
+    organizationId,
+    shop
+  })).toString("base64url");
+  const signature = import_crypto3.default.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(payload).digest("base64url");
+  return payload + "." + signature;
+};
+var verifyOAuthState = (raw) => {
+  if (!raw) return null;
+  const [payload, signature] = raw.split(".");
+  if (!payload || !signature) return null;
+  const expected = import_crypto3.default.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(payload).digest("base64url");
+  if (signature.length !== expected.length) return null;
+  const valid = import_crypto3.default.timingSafeEqual(
+    Buffer.from(signature),
+    Buffer.from(expected)
+  );
+  if (!valid) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(payload, "base64url").toString());
+  } catch {
+    return null;
+  }
+  ;
+  if (!(parsed == null ? void 0 : parsed.exp) || parsed.exp < Date.now()) return null;
+  return parsed;
+};
+var verifyOAuthCallbackHmac = ({ hmac, rawQuery }) => {
+  const message = (rawQuery || "").split("&").filter((pair) => !pair.startsWith("hmac=")).sort((a, b) => {
+    const nameA = a.split("=")[0];
+    const nameB = b.split("=")[0];
+    return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
+  }).join("&");
+  const digest = import_crypto3.default.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(message).digest("hex");
+  const digestBuf = Buffer.from(digest);
+  const hmacBuf = Buffer.from(hmac || "");
+  return digestBuf.length === hmacBuf.length && import_crypto3.default.timingSafeEqual(digestBuf, hmacBuf);
+};
 var shopifyOAuthFetch = async (url, body) => {
   const response = await fetch(url, {
     method: "POST",
@@ -199,5 +245,8 @@ var getAdminToken = async ({ connection, controller }) => {
   getAdminToken,
   ping,
   refreshAdminToken,
-  resolveConnectionSettings
+  resolveConnectionSettings,
+  signOAuthState,
+  verifyOAuthCallbackHmac,
+  verifyOAuthState
 });

package/dist/shopify.d.cts

@@ -1,10 +1,100 @@
+import crypto from 'crypto';
 import { decrypt, encrypt } from './encrypt.cjs';
-import 'crypto';
 import './token.cjs';
 
 const SHOPIFY_ADMIN_API_VERSION = '2025-01';
 const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
 const ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const OAUTH_STATE_TTL_MS = 5 * 60 * 1000;
+
+const signOAuthState = ({ organizationId, shop }) => {
+
+	const payload = Buffer.from( JSON.stringify({
+		exp : Date.now() + OAUTH_STATE_TTL_MS,
+		organizationId,
+		shop
+	}) ).toString( 'base64url' );
+
+	const signature = crypto
+		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
+		.update( payload )
+		.digest( 'base64url' );
+
+	return payload + '.' + signature;
+
+};
+
+const verifyOAuthState = ( raw ) => {
+
+	if( ! raw ) return null;
+
+	const [ payload, signature ] = raw.split( '.' );
+
+	if( ! payload || ! signature ) return null;
+
+	const expected = crypto
+		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
+		.update( payload )
+		.digest( 'base64url' );
+
+	if( signature.length !== expected.length ) return null;
+
+	const valid = crypto.timingSafeEqual(
+		Buffer.from( signature ),
+		Buffer.from( expected )
+	);
+
+	if( ! valid ) return null;
+
+	let parsed;
+
+	try {
+
+		parsed = JSON.parse( Buffer.from( payload, 'base64url' ).toString() );
+
+	} catch {
+
+		return null;
+
+	}
+	if( ! parsed?.exp || parsed.exp < Date.now() ) return null;
+
+	return parsed;
+
+};
+
+// Verifies the HMAC Shopify includes on OAuth callback query strings. Sort by
+// parameter NAME (not full key=value pair) per Shopify spec — matches the
+// official @shopify/shopify-api SDK. A plain .sort() compares whole strings,
+// which would diverge when one name is a prefix of another and the next char
+// sorts before '=' in ASCII (e.g. `state` vs `state2`).
+const verifyOAuthCallbackHmac = ({ hmac, rawQuery }) => {
+
+	const message = ( rawQuery || '' )
+		.split( '&' )
+		.filter( pair => ! pair.startsWith( 'hmac=' ) )
+		.sort( ( a, b ) => {
+
+			const nameA = a.split( '=' )[ 0 ];
+			const nameB = b.split( '=' )[ 0 ];
+
+			return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
+
+		})
+		.join( '&' );
+
+	const digest = crypto
+		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
+		.update( message )
+		.digest( 'hex' );
+
+	const digestBuf = Buffer.from( digest );
+	const hmacBuf = Buffer.from( hmac || '' );
+
+	return digestBuf.length === hmacBuf.length
+		&& crypto.timingSafeEqual( digestBuf, hmacBuf );
+
+};
 
 const shopifyOAuthFetch = async ( url, body ) => {
 
@@ -166,4 +256,4 @@ const getAdminToken = async ({ connection, controller }) => {
 
 };
 
-export { getAdminToken, ping, refreshAdminToken, resolveConnectionSettings };
+export { getAdminToken, ping, refreshAdminToken, resolveConnectionSettings, signOAuthState, verifyOAuthCallbackHmac, verifyOAuthState };

package/dist/shopify.d.ts

@@ -1,10 +1,100 @@
+import crypto from 'crypto';
 import { decrypt, encrypt } from './encrypt.js';
-import 'crypto';
 import './token.js';
 
 const SHOPIFY_ADMIN_API_VERSION = '2025-01';
 const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
 const ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const OAUTH_STATE_TTL_MS = 5 * 60 * 1000;
+
+const signOAuthState = ({ organizationId, shop }) => {
+
+	const payload = Buffer.from( JSON.stringify({
+		exp : Date.now() + OAUTH_STATE_TTL_MS,
+		organizationId,
+		shop
+	}) ).toString( 'base64url' );
+
+	const signature = crypto
+		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
+		.update( payload )
+		.digest( 'base64url' );
+
+	return payload + '.' + signature;
+
+};
+
+const verifyOAuthState = ( raw ) => {
+
+	if( ! raw ) return null;
+
+	const [ payload, signature ] = raw.split( '.' );
+
+	if( ! payload || ! signature ) return null;
+
+	const expected = crypto
+		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
+		.update( payload )
+		.digest( 'base64url' );
+
+	if( signature.length !== expected.length ) return null;
+
+	const valid = crypto.timingSafeEqual(
+		Buffer.from( signature ),
+		Buffer.from( expected )
+	);
+
+	if( ! valid ) return null;
+
+	let parsed;
+
+	try {
+
+		parsed = JSON.parse( Buffer.from( payload, 'base64url' ).toString() );
+
+	} catch {
+
+		return null;
+
+	}
+	if( ! parsed?.exp || parsed.exp < Date.now() ) return null;
+
+	return parsed;
+
+};
+
+// Verifies the HMAC Shopify includes on OAuth callback query strings. Sort by
+// parameter NAME (not full key=value pair) per Shopify spec — matches the
+// official @shopify/shopify-api SDK. A plain .sort() compares whole strings,
+// which would diverge when one name is a prefix of another and the next char
+// sorts before '=' in ASCII (e.g. `state` vs `state2`).
+const verifyOAuthCallbackHmac = ({ hmac, rawQuery }) => {
+
+	const message = ( rawQuery || '' )
+		.split( '&' )
+		.filter( pair => ! pair.startsWith( 'hmac=' ) )
+		.sort( ( a, b ) => {
+
+			const nameA = a.split( '=' )[ 0 ];
+			const nameB = b.split( '=' )[ 0 ];
+
+			return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
+
+		})
+		.join( '&' );
+
+	const digest = crypto
+		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
+		.update( message )
+		.digest( 'hex' );
+
+	const digestBuf = Buffer.from( digest );
+	const hmacBuf = Buffer.from( hmac || '' );
+
+	return digestBuf.length === hmacBuf.length
+		&& crypto.timingSafeEqual( digestBuf, hmacBuf );
+
+};
 
 const shopifyOAuthFetch = async ( url, body ) => {
 
@@ -166,4 +256,4 @@ const getAdminToken = async ({ connection, controller }) => {
 
 };
 
-export { getAdminToken, ping, refreshAdminToken, resolveConnectionSettings };
+export { getAdminToken, ping, refreshAdminToken, resolveConnectionSettings, signOAuthState, verifyOAuthCallbackHmac, verifyOAuthState };

package/dist/shopify.js

@@ -5,9 +5,52 @@ import {
 import "./chunk-HOA2JHXC.js";
 
 // shopify.js
+import crypto from "crypto";
 var SHOPIFY_ADMIN_API_VERSION = "2025-01";
 var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
 var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var OAUTH_STATE_TTL_MS = 5 * 60 * 1e3;
+var signOAuthState = ({ organizationId, shop }) => {
+  const payload = Buffer.from(JSON.stringify({
+    exp: Date.now() + OAUTH_STATE_TTL_MS,
+    organizationId,
+    shop
+  })).toString("base64url");
+  const signature = crypto.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(payload).digest("base64url");
+  return payload + "." + signature;
+};
+var verifyOAuthState = (raw) => {
+  if (!raw) return null;
+  const [payload, signature] = raw.split(".");
+  if (!payload || !signature) return null;
+  const expected = crypto.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(payload).digest("base64url");
+  if (signature.length !== expected.length) return null;
+  const valid = crypto.timingSafeEqual(
+    Buffer.from(signature),
+    Buffer.from(expected)
+  );
+  if (!valid) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(payload, "base64url").toString());
+  } catch {
+    return null;
+  }
+  ;
+  if (!(parsed == null ? void 0 : parsed.exp) || parsed.exp < Date.now()) return null;
+  return parsed;
+};
+var verifyOAuthCallbackHmac = ({ hmac, rawQuery }) => {
+  const message = (rawQuery || "").split("&").filter((pair) => !pair.startsWith("hmac=")).sort((a, b) => {
+    const nameA = a.split("=")[0];
+    const nameB = b.split("=")[0];
+    return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
+  }).join("&");
+  const digest = crypto.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(message).digest("hex");
+  const digestBuf = Buffer.from(digest);
+  const hmacBuf = Buffer.from(hmac || "");
+  return digestBuf.length === hmacBuf.length && crypto.timingSafeEqual(digestBuf, hmacBuf);
+};
 var shopifyOAuthFetch = async (url, body) => {
   const response = await fetch(url, {
     method: "POST",
@@ -127,5 +170,8 @@ export {
   getAdminToken,
   ping,
   refreshAdminToken,
-  resolveConnectionSettings
+  resolveConnectionSettings,
+  signOAuthState,
+  verifyOAuthCallbackHmac,
+  verifyOAuthState
 };

package/package.json

@@ -86,5 +86,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.22"
+  "version": "0.0.24"
 }